Ember Migraine Tracker

Consumer Health Data Privacy Notice

Last updated: October 4, 2026

Cascade Headache, PLLC operates Ember. This notice supplements our Privacy Policy for Washington residents and people whose consumer health data is collected in Washington.

Information and sources

Depending on your choices, Ember handles headache and migraine records; symptoms, severity, impact and notes; medications and treatment history; menstrual-cycle and questionnaire information; profile and care details; connected Apple Health or Health Connect readings; and observations or saved experiment results derived from those records.

Information comes from you, device health sources you authorize, and calculations within Ember. Optional network features also handle encrypted backup content, account-linked backup and security metadata, a city or approximate coordinates for weather, and support text and screenshots you choose to send, your account email for replies, and contact-delivery/security metadata. Identifiers and inferences associated with health information may themselves be consumer health data.

Purposes and choices

We use this information to provide requested tracking, connected-health, observations, reports, exports, optional backup and recovery, weather, account security and support. We collect or share consumer health data with consent where required, or as necessary to provide a product or service you request where the law permits that basis. We do not treat a general acceptance of terms as consent to unrelated uses.

Core diary records are local. Optional automatic backup sends eligible records encrypted on the device to Google Cloud. Imported raw Health readings are excluded from backups; saved experiments can include Health-derived results. Recovery material is kept separately on the device and, if chosen and supported, through iCloud Keychain or Google Block Store.

Where in-app contact is available, pressing Send message requests delivery of your text and selected screenshot to our support team through Google Cloud, Paubox and Google Workspace. Your diary is not automatically attached. Screenshots may contain health information; include only what you want to share. Contact content does not use automatic-backup recovery-key encryption. You can choose not to send or attach a screenshot.

In the upcoming internal test build, optional navigation sharing starts on unless previously turned off and sends approved screen-open, navigation-tap and adjacent-transition counts to Google Cloud/Firebase to improve navigation. Counts include platform/build and a UTC day, but exclude clinical contents and account identifiers. Use of a migraine app can itself imply health interests. Sharing can be stopped in Settings → About → Help improve Ember without losing app access. This internal testing behavior is not a statement that consent requirements for general distribution have been met. Local pending counts expire within seven days, retry receipts after fourteen days and pooled totals after ninety days, with automatic deletion completing asynchronously. See the Privacy Policy for withdrawal, retention and processor details.

Recipients

Depending on the feature you use, Ember shares these categories with the following recipients:

GitHub Pages receives website connection information when you visit this site. Not every recipient receives your diary; Google Cloud receives encrypted backup content and operational metadata, while weather requests exclude diary and medication records. The data each recipient receives and the purpose are described in the Privacy Policy.

If you share a report or export, the recipient and sharing service you select receive that information. We may disclose information where required by law, subject to applicable restrictions. We do not sell consumer health data, use it for targeted advertising, or use geofences around healthcare facilities for the prohibited health-related purposes.

Your rights

We do not share consumer health data with other businesses under common ownership or control. Reports you choose to send to your clinician are handled separately.

You may request confirmation of collection, sharing or sale; access to your consumer health data and the required list of relevant third-party and affiliate recipients with contact information; withdrawal of applicable consent; and deletion of consumer health data, including applicable downstream and backup copies.

Email hello@cascadeheadache.com with the subject “Washington consumer health data request.” Sam handles requests for Cascade Headache, PLLC. Describe the action requested and provide the account email. Do not send a diary, password or recovery code. We may ask for information reasonably necessary to authenticate the request and will not require a new account solely to submit it.

We respond without undue delay and within 45 days of receipt. If a legally permitted extension is necessary, we explain the reason within that initial period. Verification, exceptions and archive/backup handling follow the applicable law; we explain any unresolved or retained information. Deletion does not remove a recovery code you keep yourself or independently held records outside our control. New account deletions automatically queue a RevenueCat customer-deletion request, processed hourly. Linked-account conflicts or service failures require review. Store transaction records, Sentry diagnostic records and support email/contact-delivery metadata need separate handling through this request process.

Appeals and complaints

If we refuse to act, you may appeal by replying to the decision or emailing the same address with “Privacy request appeal” in the subject. We review the request again and explain the result and reasons in writing within 45 days. If the appeal is denied, you can submit a complaint to the Washington Attorney General.

Security and changes

We maintain safeguards appropriate to the information, including access restrictions and client-side encryption for automatic-backup content. We provide notice and obtain affirmative consent where required before collecting, using or sharing an additional category of consumer health data or using it for an additional purpose.

Operator: Cascade Headache, PLLC
4405 7th Ave SE
STE 200, PMB 2872
Lacey, WA 98503
Contact: hello@cascadeheadache.com